Several days ago, I dropped my USB external hard disk. As a result, I cannot read some of the files. I would like to recover it, and now I am using safecopy. I used the following command,
sudo safecopy /dev/sdb1 data.img --stage1
However, at around 93%, then there is a message something like "cannot read from source".
Then I tried to mount this partially recovered image, but failed. What are the things I can do more to recover the data?
==================================================================
I have tried to use
sudo safecopy /dev/sdb data.img --stage1
Now, it is done. Then, I
fdisk -lu data.img
It produces this result,
Disk data.img: 310.8 GB, 310798626816 bytes
255 heads, 63 sectors/track, 37785 cylinders, total 607028568 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0xb1bec32c
Device Boot Start End Blocks Id System
data.img1 63 625137344 312568641 7 HPFS/NTFS/exFAT
Then, I tried to mount with
sudo mount -o loop,offset=32256 -t ntfs data.img /mnt/temp
but failed with this output
Failed to read last sector (625137281): Invalid argument
HINTS: Either the volume is a RAID/LDM but it wasn't setup yet,
or it was not setup correctly (e.g. by not using mdadm --build ...),
or a wrong device is tried to be mounted,
or the partition table is corrupt (partition is smaller than NTFS),
or the NTFS boot sector is corrupt (NTFS size is not valid).
Failed to mount '/dev/loop0': Invalid argument
The device '/dev/loop0' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?
How should I do to recover the data from here?
Best Answer
First, you may want to try
safecopy --stage2
andsafecopy --stage3
as well, to try to extract a little more from the disk.If your copy is partial, you have a damaged filesystem. Run
fsck
on it (e.g.fsck -y copy-of-data.img
) to attempt to repair. Note that for NTFS, you'll need a recent version of NTFS-3g. Repairing means turning the filesystem into a valid filesystem, it may well lose some of the data. So do this on a copy of the image. Then mount the image and try to recover files from it:sudo mount -o loop copy-of-data.img /mnt
. Note that iffsck
finds some data that it's unable to relate to a file name, it'll store it under thelost+found
directory.Sometimes, when
fsck
runs, it discards data because that data doesn't seem to belong to any file. A different approach for data recovery is to look for fragments on the disk that look like useful data. This works especially well for file formats that have a recognizable header, such as pictures. So try running carving tools on the copy of the disk image where you haven't runfsck
. See How to recover data from a bad SD card? If these carving tools aren't easily available on your system, try the Testdisk live CD.